Exam 312-50v13 topic 1 question 29 discussion

White hat would have permission to test the system, Gray Hat don't have permission but are not malicious actors (Black hat) since Nicolas didn't have permission from the owner or microsoft he is a Gray hat

Gray hat fits better because: Nicolas likely discovered this vulnerability without explicit permission (even on a public-facing system, unauthorized testing can be legally questionable) He operated in the ethical middle ground - not malicious, but potentially outside legal boundaries Gray hat hackers often do exactly this: find vulnerabilities without permission but then responsibly disclose them The key distinction: White hat = Authorized testing with permission (bug bounties, contracted pentesting, etc.) Gray hat = Unauthorized discovery but ethical disclosure Black hat = Malicious intent and exploitation

Its a public facing system so he doesnt need permission

This type of hacker finds vulnerabilities without malicious intent but may access systems without explicit permission. They typically disclose these vulnerabilities to the affected parties to improve security but do not seek authorization before testing, which is a gray area in terms of legality and ethics.

White hat hackers are ethical hackers who find and report vulnerabilities with the intention of improving security. They typically notify the affected organization (in this case, the system owner and Microsoft) to help protect users from potential exploits.

C. Gray hat. Gray hat hackers find vulnerabilities without malicious intent but may still test systems without permission. They often disclose vulnerabilities responsibly to system owners or vendors, even if they initially accessed the system without authorization. Unlike white hat hackers, who only test systems with prior consent, gray hats may act without permission but with good intentions.

Is gray hat